DLink #DSL2750B OS Command Injection Exploit

This Metasploit module exploits a remote command injection vulnerability in D-Link DSL-2750B devices. Vulnerability can be exploited through "cli" parameter that is directly used to invoke "ayecli" binary. Vulnerable firmwares are from 1.01 up to 1.03. This module requires Metasploit:...

D-Link DSL-2750B - OS Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'D-Link DSL-2750B OS Command Injection', 'Description' = %q This module exploits a remote command injection vulnerability in D-Link DSL-2750B...

Open-Xchange: command Injection in rawlog binary

Quick Overview I have found a Command Injection vulnerability in the code where a method calls an OS Shell command using an untrusted string to execute. Introduction Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable...

Command injection

Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion...

CVE-2018-4924

Adobe Dreamweaver CC versions 18.0 and earlier have an OS Command Injection vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user...

CVE-2018-4923

Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion...

CVE-2018-4924

Adobe Dreamweaver CC versions 18.0 and earlier have an OS Command Injection vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user...

CVE-2018-4923

CVE-2018-4923 affects Adobe Connect versions 9.7 and earlier. The vulnerability is an OS command injection in the Adobe Connect URI handler, enabling exploitation that could lead to arbitrary file deletion. Published references confirm this issue and connect it with APSB18-06 updates, which addre...

CVE-2018-4924

CVE-2018-4924 affects Adobe Dreamweaver CC versions 18.0 and earlier. An OS command injection in the Dreamweaver URI handler could allow arbitrary code execution in the context of the current user. The issue is documented across multiple sources (NVD and Adobe APSB18-07). Remediation is available...

Exploit for OS Command Injection in Dasannetworks Gpon_Router_Firmware

GPON-LOADER Exploit loader for Remote...

CVE-2018-10730

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection...

CVE-2018-10730

CVE-2018-10730 affects Phoenix Contact FL SWITCH 3xxx/4xxx/48xx series running firmware 1.0–1.33. The vulnerability is a command injection in the OS shell triggered when transferring configuration files or upgrading firmware. Risk is high (CVSS v3 base 9.1) with remote exploitation possible accor...

Node.js third-party modules: Insecure implementation of deserialization in cryo

I would like to report code injection in serialization package cryo It allows execute arbitrary code using custom prototype. Module module name: cryo version: 0.0.6 npm page: https://www.npmjs.com/package/cryo Module Description JSON on steroids. Built for node.js and browsers. Cryo is inspired b...

EMC RecoverPoint 4.3 - 'Admin CLI' Command Injection

Exploit Title: EMC RecoverPoint 4.3 - Admin CLI Command Injection Version: RecoverPoint prior to 5.1.1 RecoverPoint for VMs prior to 5.0.1.3 Date: 2018-05-11 Exploit Author: Paul Taylor Github: https://github.com/bao7uo Tested on: RecoverPoint for VMs 4.3, RecoverPoint 4.4.SP1.P1 CVE: CVE-2018-11...

CVE-2018-1239

Dell EMC Unity Operating Environment OE versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unit...

Silex Technology SX-500/SD-320AN or GE Healthcare MobileLink (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION : Exploitable Remotely / Low skill level to exploit / Public exploits are available Vendors : Silex Technology, GE Healthcare Equipment : SX-500, SD-320AN, MobileLink Vulnerabilities : Improper Authentication, OS Command Injection 2. UPDATE INFORMATION...

CVE-2018-8735

Remote command execution RCE vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection...

CVE-2018-8735

Remote command execution RCE vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection...

Command injection

Remote command execution RCE vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection...

CVE-2018-8735

Remote command execution RCE vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection...